MAL-2026-17420 Malicious code in online-header (npm)

[email protected] is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose preinstall lifecycle script runs node callback.js. callback.js collects host identifiers — os.hostname(), os.userInfo().username, __dirname install path, Node version, os.platform() and os.arch() — and POSTs them via https.request to the hardcoded Burp Collaborator OAST endpoint https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com, with a DNS-based backup channel to the same subdomain. On any build system that resolves online-header from the public registry (for example, an internal package of the same name shadowed by this public release), npm install automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control.

The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.